Risks

We face risks every day. Just leaving your home to go to work involves some riskyour car won't start, the train will be late, you will be assigned to share an office with the boring person with body odor problems. But still we go to work each day, because we know the risks and consider the outcome to be worth the risk.

However, once we are at work, we might well plunge into situations where we have no idea of the risks involved, and thus no idea whether the outcome is worth braving the risks.

Pop quiz time: Have you ever worked on a project where nothing went wrong? No? Something always goes wrong. Now, did you ever try and figure out ahead of time what could go wrong, and do something to prevent it going wrong, or at least allow for the mishaps by budgeting for them? This, in its simplest sense, is risk management.

Your blastoff process should include a short risk analysis. Such an assessment is probably outside the remit of the business analyst, and should be done by a competent risk-assessment person. The job is to assess the risks that are most likely to happen and the risks that will have the greatest impact if they do, in fact, become problems. The deliverables from your blastoff provide input for the risk assessor to identify risks. For each identified risk, the assessor determines the probability of it becoming a problem, along with its cost or schedule impact. At the same time, the assessor determines the early-warning signsthe happenings that signal a risk is coming to fruition. In some cases where the risks are considered serious, a risk manager is assigned to monitor for the telltale signs that some risks are turning into full-blown problems.

DeMarco, Tom, and Tim Lister. Waltzing with Bears: Managing Risk on Software Projects. Dorset House, 2003.

Risk management is common-sense project management or, in the words of our partner Tim Lister, "project management for adults." If your organization is not doing it, then you should prepare for the budget or time overruns that are coming your way. The most noticeable effect of doing risk analysis is that it makes the risks visible to all stakeholders. Once aware of the risks, they can contribute to risk mitigation. Similarly, the risk assessor makes management aware of the risks and their impact if they become problems.